Agari Email Trustindex.™
Total Page:16
File Type:pdf, Size:1020Kb
AGARI EMAIL 2013 TRUSTINDEX 2ND QUARTER EDITION 100 S. ELLSWORTH AVENUE, SUITE 400 : SAN MATEO, CA 94401 : 650.687.5000 ©2013 Agari www.agari.com IntroduCtion to AGARI’S TRUSTIndex – THE BENCHMARK on THreat & Consumer ProteCtion As phishing attacks get more sophisticated and harder to distinguish, consumers should know who’s putting them at risk – where malicious email links are lurking that lead to the installation of malware that can record keystrokes and steal consumer information, from online credentials to actual money. That’s why we publish the Agari TrustIndex™, to show consumers and business alike where consumers are most protected or vulnerable to email attack across industry sectors including Financial Services, E-Commerce, Social Me- Many consumers are still dia, Travel, Logistics and Gaming. Many consumers are still unaware that over 95% of data breaches start with a phishing email1– the Agari unaware that over of 95% TrustIndex™ uncovers which sectors are the most heavily targeted by data breaches start with a attackers and which industries are doing little in the way of consumer phishing email protection. The most significant, but not at all surprising discovery comes from Financial Services where there has been a huge spike in malicious activity, more than doubling from the prior quarter. In fact, consumers are 7 times more likely to receive a malicious email from their bank than from any other type of company – a sobering statistic given the increased reliance on email as a consumer engagement channel. While Financial Services has repeatedly been the target of attacks, and some of the largest banks are hustling to stop the abuse within their technology backend, still less than half of companies are completely securing email and winning back consumer confidence. Where else should consumers think twice before clicking that link? Travel. This sector, and the airlines in particular, is doing the least of all industries we analyzed to secure email and prevent their consumers from becoming victims of an attack. Even airlines like JetBlue that are well known for being leaders in delivering a better digital experience, are putting customers at risk with very little effort in preventing these types of attacks. “Ranking companies and Industries based on our ThreatScore™ and TrustScore™ benchmarks finally gives consumers and leading brands visibility into where the target is moving, how aggressively a sector is being threatened, and which companies are taking action to secure email and protect consumer data and trust,” explained Bob Pratt, Agari’s Vice President of Product Management and an enterprise security veteran. “At Agari we’ve analyzed over a trillion emails and blocked over a billion malicious messages – using this data intelligence, we can quantify the industries that are most at risk of attack, identify exactly how attacks are being carried out, and share that knowledge with the consumer and business sectors so that we can put a stop to it.” OVERVieW: HoW THE SECtors StaCK UP Agari monitored dozens of domains and millions of emails across six major economic sectors for the three months ending June 30, 2013. The Agari TrustIndex™ is composed of two variables, the TrustScore™ and ThreatScore™. The TrustScore™ reflects adoption and deployment of security measures like DMARC (Domain-based Message Authentication, Reporting and Conformance), the most reliable standard for email security. When fully implemented, DMARC virtually eliminates brand abuse through fraudulent email attacks and drastically reduces the risks of 1 Source: Verizon 2012 Data Breach Investigations Report ©2013 Agari www.agari.com 2 consumer loss, reputation damage and financial liability. In fact, 80% of email receivers in the U.S. like Gmail, Yahoo!, Microsoft and AOL have implemented DMARC as a testament to its effectiveness, but that fact alone won’t protect consumers from phishing attacks until the email sending side takes action too. 80% of email receivers in the U.S. like Gmail, Yahoo!, Microsoft and AOL have implemented DMARC as a testament to its effectiveness, but that fact alone won’t protect consumers from phishing attacks until the email sending side takes action too. The Agari ThreatScore™ provides a measure of relative risk based on malicious activity and attempted attacks. The metric’s value is a function of the volume of fraudulent emails and legitimate emails sent on a worldwide basis for each domain measured in a given sector. By analyzing changes in ThreatScore™, information security experts assess relative risk compared to other industries and industry averages. And it’s not only Chief Information Security Officers who should be paying attention to these trends – Chief Marketing Officers have a lot at stake too. A recent Gartner study shows that nearly 60% of consumers affected by a phishing attack lost trust in email and changed their online shopping behaviors as a result. Chief Marketing Officers have a lot at stake too. A recent Gartner study shows that nearly 60% of consumers affected by a phishing attack lost trust in email and changed their online shopping behaviors as a result. Agari Q2 TrustScores ©2013 Agari www.agari.com 3 Agari Q2 ThreatScores SOCIAL Media – Inspiring BRAND TRUST in Email Sector Agari TrustScore Agari ThreatScoreTM down Social Media up 73 1% 0.50 19% Consumers may be worried about their privacy settings, but in terms of protecting consumers via email, Social Media is the clear leader scoring 73 out of 100 with nearly all of the major social brands reinforcing brand trust by prioritizing email security. With companies such as Facebook, Twitter, Pinterest and Google continuing to invest to protect their email channel and deploy standards such as DMARC, Social Media boasts the strongest defenses in the Consumers may be worried about their privacy settings, but in terms of protecting consumers via email, Social Media is the clear leader ©2013 Agari www.agari.com 4 industry with a TrustIndex of 73. What changed since last quarter? Instagram – now a fully integrated division of Facebook – stepped up its defenses with additional investment in user trust; its score increased 10 percent, raising the sector’s index by eight-tenths of 1 percent. Facebook and Twitter – two of six companies – recorded perfect scores, the 90th percentile of this quarter’s index. Also of note, LinkedIn and Google trailed by razor-thin margins, delivering close to perfect scores and bolstering the strength of the sector. What does this mean to the cyber-criminals? “Good news and bad news,” Pratt suggested. “Good news is that Social Media has the best defenses. Bad news is that the cyber-criminals are turning their attention to other sectors that are significantly more vulnerable.” Indeed, Social Media recorded one of the lowest ThreatScores™ of the second quarter – 0.50 – a full nineteen percent drop over the first quarter. Looking ahead into the third quarter, what’s in store? Most expect the sector to continue to top the TrustIndex although MySpace, the sector laggard, will continue to keep the sector from achieving across the board strong scores. FinanCIAL SERVICes – HigH RISK, BUT Pounding THE PAVEMENT to FortifY Defenses Sector Agari TrustIndex Score Agari ThreatScoreTM Financial Services up up 39.7 7% 7.14 122% If there’s a sector where consumers should be wary, it’s Financial Services. While this sector continues to make gains, increasing its TrustScore™ 7% over the previous quarter, companies have excellent reason to be diligent – Financial Services remains the industry most susceptible to phishing attacks, as consumers are 7 times more likely to be the victim of an attack with an email from their bank versus consumers are 7 times more any other sector. likely to be the victim of an The good news is financial companies are hearing wake-up call; attack with an email from their banks, credit unions, investment firms and insurance corporations bank versus any other sector aggressively embraced DMARC to protect customer trust and safeguard their email channels. Good thing they did, because threat levels increased 122% in the last ninety days, the most dramatic increase of any sector. The FS-ISAC (Financial Services Information Sharing and Analysis Center) Spring Conference – an annual gathering of senior information security executives from the financial services industry – is credited with increasing the ©2013 Agari www.agari.com 5 awareness of DMARC and email authentication. This year’s conference featured powerful testimonies from representatives of JP Morgan Chase and NACHA.org – the electronic payments association – encouraging the industry to embrace DMARC and more reliable email security measures before they fall prey to a phishing attack. Indeed, U.S. Bank and Capital One, shored up their email defenses, helping to raise the sector’s TrustIndex score by an impressive 7 percent, the largest single-quarter gain in its history. American Express and PayPal also contributed to the sector’s strength with higher-than-average performance. A few laggards, however, prevented the sector’s growth from reaching even higher heights. Large retail and institutional banks have not focused on email authentication, weighing down the industry’s performance, and larger banks as well are still wrestling with the early steps to get to full DMARC enabled authentication. “Time is not their friend,” warned Pratt of the complacency of companies who are not taking an aggressive stand to authenticate email. “Our studies have validated that the Financial Services industry is the sector which is most vulnerable to a phishing attack, potentially costing innocent consumers millions of dollars.” How vulnerable? This quarter’s Financial Services ThreatScore™ reached 7.14, the highest of the sectors and almost fourteen times higher than Social Media. “There really is no excuse for a bank or credit union to continue to turn a blind eye or a deaf ear to DMARC,” continued Pratt.